Analysis
-
max time kernel
148s -
max time network
124s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
30-06-2020 06:05
Static task
static1
Behavioral task
behavioral1
Sample
benzway.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
benzway.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
benzway.exe
-
Size
686KB
-
MD5
b299b28f77a9de1c0f5bb30cf8522aa2
-
SHA1
ae5ec84f56c65239862745ef217d6b883f0375d6
-
SHA256
ae438370eda70ba48a763c526e61b068e16d11cbd00e9cb504d6f1eeb7442d22
-
SHA512
2180b191e4a5bf82443c85e74f68bf63ea6a821ac26813c46e50acf4fda5cdbb6303f1f13510c18e0081ac3ffcf563857c76ce05fffafcde3a6d763373d007ec
Malware Config
Signatures
-
Drops file in Program Files directory 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Program Files (x86)\Xcbcpfzx\vganpwdbb.exe explorer.exe -
Processes:
explorer.exedescription ioc process Key created \Registry\User\S-1-5-21-910373003-3952921535-3480519689-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 explorer.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
benzway.exebenzway.exeexplorer.exedescription pid process target process PID 1304 set thread context of 1404 1304 benzway.exe benzway.exe PID 1404 set thread context of 1312 1404 benzway.exe Explorer.EXE PID 1428 set thread context of 1312 1428 explorer.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
benzway.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1404 benzway.exe Token: SeDebugPrivilege 1428 explorer.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key created \Registry\Machine\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\YLZXPLEHI = "C:\\Program Files (x86)\\Xcbcpfzx\\vganpwdbb.exe" explorer.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1536 cmd.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
benzway.exebenzway.exeexplorer.exepid process 1304 benzway.exe 1404 benzway.exe 1404 benzway.exe 1404 benzway.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE 1312 Explorer.EXE -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
benzway.exebenzway.exeexplorer.exepid process 1304 benzway.exe 1404 benzway.exe 1404 benzway.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe 1428 explorer.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
benzway.exeExplorer.EXEexplorer.exedescription pid process target process PID 1304 wrote to memory of 1404 1304 benzway.exe benzway.exe PID 1304 wrote to memory of 1404 1304 benzway.exe benzway.exe PID 1304 wrote to memory of 1404 1304 benzway.exe benzway.exe PID 1304 wrote to memory of 1404 1304 benzway.exe benzway.exe PID 1312 wrote to memory of 1428 1312 Explorer.EXE explorer.exe PID 1312 wrote to memory of 1428 1312 Explorer.EXE explorer.exe PID 1312 wrote to memory of 1428 1312 Explorer.EXE explorer.exe PID 1312 wrote to memory of 1428 1312 Explorer.EXE explorer.exe PID 1428 wrote to memory of 1536 1428 explorer.exe cmd.exe PID 1428 wrote to memory of 1536 1428 explorer.exe cmd.exe PID 1428 wrote to memory of 1536 1428 explorer.exe cmd.exe PID 1428 wrote to memory of 1536 1428 explorer.exe cmd.exe PID 1428 wrote to memory of 1292 1428 explorer.exe Firefox.exe PID 1428 wrote to memory of 1292 1428 explorer.exe Firefox.exe PID 1428 wrote to memory of 1292 1428 explorer.exe Firefox.exe PID 1428 wrote to memory of 1292 1428 explorer.exe Firefox.exe PID 1428 wrote to memory of 1292 1428 explorer.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\benzway.exe"C:\Users\Admin\AppData\Local\Temp\benzway.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\benzway.exe"C:\Users\Admin\AppData\Local\Temp\benzway.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Suspicious behavior: MapViewOfSection
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\benzway.exe"3⤵
- Deletes itself
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\J4PBC1UW\J4Plogim.jpeg
-
C:\Users\Admin\AppData\Roaming\J4PBC1UW\J4Plogrf.ini
-
C:\Users\Admin\AppData\Roaming\J4PBC1UW\J4Plogri.ini
-
C:\Users\Admin\AppData\Roaming\J4PBC1UW\J4Plogrv.ini
-
memory/1292-11-0x0000000000000000-mapping.dmp
-
memory/1292-12-0x000000013FAA0000-0x000000013FB33000-memory.dmpFilesize
588KB
-
memory/1404-1-0x000000000041E2E0-mapping.dmp
-
memory/1404-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/1428-3-0x0000000000500000-0x0000000000781000-memory.dmpFilesize
2.5MB
-
memory/1428-10-0x0000000003CE0000-0x0000000003E2F000-memory.dmpFilesize
1.3MB
-
memory/1428-7-0x0000000076010000-0x000000007612D000-memory.dmpFilesize
1.1MB
-
memory/1428-6-0x0000000076680000-0x000000007668C000-memory.dmpFilesize
48KB
-
memory/1428-5-0x0000000003330000-0x0000000003488000-memory.dmpFilesize
1.3MB
-
memory/1428-2-0x0000000000000000-mapping.dmp
-
memory/1536-4-0x0000000000000000-mapping.dmp